Keys of higher risk should be done more frequently. How frequently is more a matter of risk (is your company a target?) + engineering bandwidth to do it.

All keys should at least be refreshed once a year. At least.

It's worth mentioning that refreshing keys could also introduce security risks if you don't have a defined process. For instance, if an engineer is consistently emailing new keys to another engineer, that's probably (most definitely) a bad idea.